Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll
-
Size
84KB
-
MD5
eae1127e600b1d267f7770af627e59a2
-
SHA1
7d27e7681772eb19f38e403325fd9620a9806bd1
-
SHA256
f8061094f878bdd90830649682983c5281d68c30f9e411e50761b85347e9d90c
-
SHA512
a82dfdc44672a240f177dd4598e62cdf5820d40a7fd007f982984b578cc00b2462eb3956e1e2f02b7630f08cd9684eb998abcb6ff7dfd9861a043f3701032d28
-
SSDEEP
1536:niK5yS2vFYmUSKvSLnY1YqF31MPfpAzLjnY1Y:niK5TK5UScSkH31Wwc
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3444 3828 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3828 2660 regsvr32.exe 82 PID 2660 wrote to memory of 3828 2660 regsvr32.exe 82 PID 2660 wrote to memory of 3828 2660 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:3828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 6003⤵
- Program crash
PID:3444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3828 -ip 38281⤵PID:1244